Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge

Cisco Talos analyzed msaRAT, a Rust implant deployed prior to Chaos ransomware encryption that spawns a headless Chrome/Edge, uses the Chrome DevTools Protocol to inject JavaScript, and tunnels encrypted C2 over a WebRTC data channel relayed via a Cloudflare Worker and Twilio TURN. The implant is delivered via an MSI masquerading as a Windows update, loads a DLL into memory, and executes commands received through the browser-driven channel; Talos published two network indicators but no file hashes.